On 8 October 2026 Citrix published security bulletin CTX697191 for CVE-2026-107406, a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It carries a CVSS v4.0 score of 9.5 and applies only to appliances configured as a SAML Identity Provider (IdP) or SAML Service Provider (SP).
Citrix says that as of publication it "is not aware of any unmitigated exploits of this vulnerability," and CISA's enrichment on the CVE record shows no known exploitation. The reason to move quickly is the recent history. CISA added NetScaler CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog on 27 September and CVE-2026-88779 on 4 October. Many teams have just finished one emergency upgrade, and the builds that fixed those bugs do not fix this one. According to the CVE records, CVE-2026-88771 was fixed in 14.1-73.37 and 13.1-64.23, and CVE-2026-88779 in 14.1-73.41 and 13.1-64.28. Both are older than the fix for CVE-2026-107406.
What's affected
The fixed builds per the CVE record and Citrix's guidance:
| Product | Fixed in |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.46 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.29 and later |
| NetScaler ADC 14.1-FIPS | 14.1-73.46 FIPS and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1.37.283 and later |
The exposure condition depends on your build, which is unusual and worth reading twice:
- Builds 14.1-73.37 through 14.1-73.41, and 13.1-64.23 through 13.1-64.28 (and the matching FIPS builds): affected only when configured as a SAML IdP.
- Builds before 14.1-73.37 and before 13.1-64.23 (and matching FIPS and NDcPP builds): affected when configured as a SAML SP or SAML IdP.
In other words, the builds that fixed the September and early October bugs narrowed the exposure to IdP configurations, and 14.1-73.46 or 13.1-64.29 removes it. Citrix also says Secure Private Access hybrid deployments that use NetScaler instances are affected and should be upgraded. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by Citrix.
How to check if you're exposed
Citrix's guidance gives the two configuration strings to look for:
- SAML SP:
add authentication samlAction - SAML IdP:
add authentication samlIdPProfile
On each appliance:
> show ns version
> show ns runningConfig | grep -i saml
Or against a saved configuration:
grep -E "add authentication (samlAction|samlIdPProfile)" /nsconfig/ns.conf
Then combine the two answers. A build of 14.1-73.46 or 13.1-64.29 or later is fixed. An older build with either SAML string present is exposed (with the IdP-only nuance above for the most recent builds). An older build with no SAML configuration is not exposed to this CVE, but should still be upgraded given the other NetScaler bulletins this quarter.
How big is the pool? BleepingComputer, citing Shadowserver, reported more than 21,000 exposed NetScaler fingerprints at the time of the bulletin, without a breakdown of how many are vulnerable.
What to do now
- Upgrade to 14.1-73.46 or 13.1-64.29 (or the FIPS and NDcPP equivalents). If you upgraded to a 14.1-73.37 to 14.1-73.41 build or a 13.1-64.23 to 13.1-64.28 build for the September and early October issues, you need this upgrade too if the appliance is a SAML IdP.
- Inventory SAML roles. Record, per appliance, whether it acts as IdP, SP, both or neither. You will need that answer for the next bulletin as well.
- Upgrade Secure Private Access hybrid deployments that rely on NetScaler instances.
- Restrict management access and keep the management interface off the internet, as with any NetScaler bulletin.
- Watch for crashes. The bug can cause denial of service, so unexpected restarts of SAML-facing virtual servers after the bulletin are worth investigating, not just restarting.
Why it matters
NetScaler sits at the authentication edge, and SAML configuration has been the precondition for more than one NetScaler bulletin this year. In March, CVE-2026-3055 was a memory overread that applied when the appliance was configured as a SAML IdP. When the same component keeps producing memory safety bugs, the cost lands on operations: every upgrade cycle needs a fresh check of which build fixes which CVE under which configuration.
The version-dependent exposure in this bulletin is a good example of why "we patched last week" is not a status. Keep per-appliance records of build, SAML role and the CVEs each build closes, and the next bulletin becomes a lookup instead of an investigation.
Try it yourself
Export ns.conf from one appliance (or run the grep above against your backups). Note the build, whether samlAction or samlIdPProfile appears, and decide from the table above whether that appliance is exposed today. Then repeat it as a script across all of them.
Click through it at your own pace, or open it full screen.
Quick check
Which configurations make NetScaler vulnerable to CVE-2026-107406?
SAML IdP or SAML SP configurations on older builds, and SAML IdP configurations only on builds 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28. Look for add authentication samlAction (SP) or add authentication samlIdPProfile (IdP).
Is a NetScaler on 14.1-73.41 fixed?
No. It is still affected if it is configured as a SAML IdP. The fixed 14.1 build is 14.1-73.46.
Do Citrix-managed cloud services need action?
No. Citrix says the bulletin does not apply to Citrix-managed cloud services or Citrix-managed Adaptive Authentication, which Citrix upgrades itself. Secure Private Access hybrid deployments using your own NetScaler instances do need upgrading.
Sources
- Citrix: Immediate guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway
- CVE-2026-107406 record (cve.org)
- CVE-2026-88771 record (cve.org)
- CVE-2026-88779 record (cve.org)
- CVE-2026-3055 record (cve.org)
- CISA Known Exploited Vulnerabilities catalog
- BleepingComputer: Citrix warns admins to patch new NetScaler RCE flaw immediately
